CVE-2026-80605: HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
In the Linux kernel, the following vulnerability has been resolved:
HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait()
In picolcdsendandwait(), an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'rawdata'. If the loop executes more than INTMAX times, 'k' becomes negative, making the condition 'k < size' true even when 'size' is 0.
Change the type of 'k' to 'unsigned int' to prevent the overflow and eliminate the out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool.
[jkosina@suse.com: extended hash length]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the resolution for the Linux kernel vulnerability labeled "[jkosina@suse.com: extended hash length]" (HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()) to fix the NULL pointer dereference/out-of-bounds access caused by the signed loop counter integer overflow (k becoming negative when the loop executes more than INT_MAX times).
Linux kernel extended hash length = resolved
Event History
Frequently Asked Questions
What conditions are required for the invalid access to occur?
The loop in picolcd_send_and_wait() would need to execute more than INT_MAX times. The signed counter can then wrap negative, allowing the loop condition to remain true when size is 0 and leading to access through a NULL raw_data pointer.
What change resolves the issue?
The resolved code changes the loop counter k from a signed integer to unsigned int. This prevents signed counter overflow and the resulting out-of-bounds access path.